@sdsrs/code-graph 0.138.0 → 0.140.0

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.138.0",
+  "version": "0.140.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/auto-update.js

@@ -35,7 +35,7 @@ function commandExists(cmd) {
 
 // ── Configuration ──────────────────────────────────────────
 const GITHUB_REPO = 'sdsrss/code-graph-mcp';
-const STATE_FILE = path.join(CACHE_DIR, 'update-state.json');
+const { UPDATE_STATE_FILE: STATE_FILE, MANIFEST_FILE, INSTALL_LOCK_FILE } = require('./cache-paths');
 const BINARY_CACHE_DIR = path.join(CACHE_DIR, 'bin');
 const CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000;        // 6h — steady-state re-check
 const UP_TO_DATE_RECHECK_MS = 30 * 60 * 1000;        // 30min — re-verify an "up to date" result (release-race guard)
@@ -956,7 +956,7 @@ async function downloadAndInstall(latest, {
           const manifest = readManifest();
           manifest.version = latest.version;
           manifest.updatedAt = new Date().toISOString();
-          writeJsonAtomic(path.join(CACHE_DIR, 'install-manifest.json'), manifest);
+          writeJsonAtomic(MANIFEST_FILE, manifest);
         } catch { /* not fatal */ }
       }
 
@@ -1272,7 +1272,7 @@ async function checkForUpdate({ installMissing = false, force = false, requestJs
       // shouldHealGlobalsOnThrottle). Cheap local check first; only the actually-
       // stale case takes the slow, lock-guarded npm path.
       if (shouldHealGlobalsOnThrottle(state)) {
-        installLock = acquireLock(path.join(CACHE_DIR, 'install.lock'));
+        installLock = acquireLock(INSTALL_LOCK_FILE);
         if (installLock) {
           const globalHeal = await selfHealGlobalPkgs({ version: state.latestVersion }, state);
           saveState({ ...readState(), ...globalHeal });
@@ -1317,7 +1317,7 @@ async function checkForUpdate({ installMissing = false, force = false, requestJs
     // it marks that with CODE_GRAPH_INSTALL_LOCK_HELD so we don't deadlock
     // against our own parent.
     if (process.env.CODE_GRAPH_INSTALL_LOCK_HELD !== '1') {
-      installLock = acquireLock(path.join(CACHE_DIR, 'install.lock'));
+      installLock = acquireLock(INSTALL_LOCK_FILE);
       // Reason, not null — same misreport as the fetch failure above: the
       // holder is mid-update, so "Up to date (v<old>)" is exactly wrong.
       if (!installLock) return { noop: true, reason: 'install-lock-held', from: installedVersion };

package/claude-plugin/scripts/cache-paths.js

@@ -0,0 +1,39 @@
+'use strict';
+// Single home for the `~/.cache/code-graph` file names.
+//
+// JS-05 (audit 2026-09-05): `update-state.json` was spelled in five modules,
+// `install.lock` in two, `install-manifest.json` in three — and two of those
+// rebuilt the whole path out of `os.homedir()` rather than joining `CACHE_DIR`,
+// so the modules that would break first if the cache layout moved were also the
+// two that never load the module where it was defined. A rename had to be found
+// by grep. `tests/hardening.rs::cache_file_names_have_exactly_one_spelling`
+// keeps this the only file that may spell them.
+//
+// Deliberately tiny and dependency-free beyond node builtins, for ONE consumer:
+// `user-prompt-context.js` runs on the UserPromptSubmit hook path and does not
+// load `lifecycle.js`, so taking a path string from there would cost it the
+// whole module. Measured at 30.1 ms as shipped versus 34.5 ms if it also loaded
+// `lifecycle.js` (+14%).
+//
+// `statusline.js` was the other hardcoded spelling and is NOT a reason for this
+// file — it already does `require('./lifecycle')`, so its copy of the three path
+// segments bought nothing. An earlier version of this comment claimed both
+// modules needed the split (pre-ship review 2026-09-07).
+const os = require('os');
+const path = require('path');
+
+const CACHE_DIR = path.join(os.homedir(), '.cache', 'code-graph');
+
+/** Auto-update bookkeeping: available version, attempt counters, last error. */
+const UPDATE_STATE_FILE = path.join(CACHE_DIR, 'update-state.json');
+/** What the last install wrote, and where. Absent = never installed. */
+const MANIFEST_FILE = path.join(CACHE_DIR, 'install-manifest.json');
+/** Inter-process install lock (see install-lock.js). */
+const INSTALL_LOCK_FILE = path.join(CACHE_DIR, 'install.lock');
+
+module.exports = {
+  CACHE_DIR,
+  UPDATE_STATE_FILE,
+  MANIFEST_FILE,
+  INSTALL_LOCK_FILE,
+};

package/claude-plugin/scripts/doctor.js

@@ -6,10 +6,11 @@ const path = require('path');
 const os = require('os');
 const { readBinaryVersion, isDevMode, getNewestMtime } = require('./version-utils');
 const {
-  getPluginVersion, readJson, readJsonResult, healthCheck, scanForBrokenPaths, CACHE_DIR,
+  getPluginVersion, readJson, readJsonResult, healthCheck, scanForBrokenPaths,
   settingsPath, surveyHookCoverage,
   installedGlobalPkgs, GLOBAL_INSTALL_MARKER, SHELL_PKG,
 } = require('./lifecycle');
+const { UPDATE_STATE_FILE } = require('./cache-paths');
 const { findBinary, clearCache: clearBinaryCache } = require('./find-binary');
 const { hidden } = require('./proc-opts');
 const { MAX_UPDATE_ATTEMPTS, GLOBAL_PKG_HEAL_MAX_ATTEMPTS, isBinaryHealExhausted, readState } = require('./auto-update');
@@ -589,7 +590,7 @@ function runDiagnostics({ checkOnly = false } = {}) {
       // this line used to hardcode 3 while the comment named the constant, so
       // raising the cap in auto-update.js would have left this diagnosis
       // reporting the old one (audit 2026-08-29 JS-07).
-      const state = readJson(path.join(CACHE_DIR, 'update-state.json')) || {};
+      const state = readJson(UPDATE_STATE_FILE) || {};
       const healGaveUp = (state.globalPkgHealAttempts || 0) >= GLOBAL_PKG_HEAL_MAX_ATTEMPTS;
       results.push({
         name: 'Global npm packages',
@@ -858,7 +859,7 @@ function probeHealth({ find = findBinary } = {}) {
 }
 
 function readUpdateState() {
-  try { return readJson(path.join(CACHE_DIR, 'update-state.json')); } catch { return null; }
+  try { return readJson(UPDATE_STATE_FILE); } catch { return null; }
 }
 
 /**

package/claude-plugin/scripts/find-binary.js

@@ -33,6 +33,34 @@ function pathProbeTimeoutMs(remaining = require('./hook-fail-open').remainingMs)
   const ms = left === null ? PATH_PROBE_MIN_MS : Math.floor(left);
   return Math.max(ms, PATH_PROBE_MIN_MS);
 }
+
+// `readBinaryVersion`'s own default. Kept here as the number this module asks
+// for so the clamp below is expressed against the same figure the callee would
+// have used on its own.
+const VERSION_PROBE_TIMEOUT_MS = 5000;
+
+/**
+ * How long ONE `--version` probe in the discovery chain may run (JS-23, audit
+ * 2026-09-07).
+ *
+ * The version gate execs the candidate binary, and `findBinary()` walks up to
+ * six candidates — so a chain of default 5 s probes is 30 s of children on the
+ * first thing every hook does, all of it BEFORE the hook has consulted its
+ * budget even once. Cold cache (first install, a version bump,
+ * `auto-update.clearCache()`) is exactly when the chain is longest and every
+ * candidate is a cold page-in.
+ *
+ * Same shape and the same two edges as `pathProbeTimeoutMs`: never 0 (node
+ * reads `timeout: 0` as no timeout), never fractional (ERR_OUT_OF_RANGE, which
+ * `readBinaryVersion`'s catch would report as "no version" → a good binary
+ * judged stale). With no deadline armed — doctor, statusline, the launcher —
+ * it returns the unchanged 5 s default.
+ */
+function versionProbeTimeoutMs(remaining = require('./hook-fail-open').remainingMs) {
+  const left = remaining(VERSION_PROBE_TIMEOUT_MS);
+  const ms = left === null ? PATH_PROBE_MIN_MS : Math.floor(left);
+  return Math.max(ms, PATH_PROBE_MIN_MS);
+}
 const PLATFORM_PKG = `@sdsrs/code-graph-${PLATFORM}-${ARCH}`;
 
 /**
@@ -129,9 +157,13 @@ function globalNodeModulesCandidates() {
 
   // 4. Last resort: ask npm directly. Slow (~50-200ms) but most accurate when
   //    user has a non-standard prefix. Cached at the disk-cache layer above.
+  // Budget-aware like the sibling probes in this file (JS-23 / pre-ship review
+  // 2026-09-07): this runs on the same `findBinaryUncached()` chain, and every
+  // hook calls `findBinary()` before it consults its own budget. `remainingMs`
+  // returns the default unchanged when nothing armed a deadline.
   try {
     const npm = npmInvocation(['root', '-g'], {
-      timeout: 2000,
+      timeout: pathProbeTimeoutMs(),
       stdio: ['pipe', 'pipe', 'pipe'],
       encoding: 'utf8',
     });
@@ -186,7 +218,9 @@ function isCachedBinaryFresh(cachedPath, pkgVersion, knownVersion) {
   // `knownVersion` lets the caller skip the `--version` spawn when the cache
   // entry already recorded it AND the file has not changed since — see
   // `readCacheEntry`. Absent, behaviour is exactly as before.
-  const cacheVer = knownVersion || readBinaryVersion(cachedPath);
+  // Clamped: this fires whenever the cache stamp mismatches — i.e. right after
+  // an auto-update, on the hook path (JS-23 / pre-ship review 2026-09-07).
+  const cacheVer = knownVersion || readBinaryVersion(cachedPath, { timeoutMs: versionProbeTimeoutMs() });
   if (!cacheVer) return true;
   return compareVersions(cacheVer, pkgVersion) >= 0;
 }
@@ -243,7 +277,9 @@ function writeCacheEntry(binPath) {
       CACHE_FILE,
       JSON.stringify({
         path: binPath,
-        version: readBinaryVersion(binPath) || null,
+        // Clamped: this is on the COLD-CACHE path, which is exactly the case
+        // JS-23 is about (pre-ship review 2026-09-07).
+        version: readBinaryVersion(binPath, { timeoutMs: versionProbeTimeoutMs() }) || null,
         stamp: binaryStamp(binPath),
       })
     );
@@ -396,13 +432,19 @@ function findPlatformBinary() {
  * gracefully on a slightly-old binary than on "offline", and the stale-binary
  * self-heal in auto-update.js re-downloads shortly anyway.
  */
-function createVersionGate(pkgVersion, { readVersion = readBinaryVersion } = {}) {
+function createVersionGate(
+  pkgVersion,
+  { readVersion = readBinaryVersion, probeTimeoutMs = versionProbeTimeoutMs } = {},
+) {
   let bestStale = null;
   return {
     consider(bin) {
       if (!isNativeBinary(bin)) return null;
       if (!pkgVersion) return bin;
-      const ver = readVersion(bin);
+      // Re-read per candidate, not once for the gate: the budget shrinks as the
+      // chain walks, and the point is that candidate six cannot still ask for a
+      // fresh 5 s (JS-23).
+      const ver = readVersion(bin, { timeoutMs: probeTimeoutMs() });
       if (!ver || compareVersions(ver, pkgVersion) >= 0) return bin;
       if (!bestStale || compareVersions(ver, bestStale.ver) > 0) bestStale = { bin, ver };
       return null;
@@ -554,6 +596,7 @@ module.exports = {
   detectLibc, unsupportedPlatformHint,
   CACHE_FILE, BINARY_NAME, PLATFORM_PKG,
   pathProbeTimeoutMs, PATH_PROBE_TIMEOUT_MS, PATH_PROBE_MIN_MS,
+  versionProbeTimeoutMs, VERSION_PROBE_TIMEOUT_MS,
 };
 
 // Allow direct invocation for testing

package/claude-plugin/scripts/lifecycle.js

@@ -12,7 +12,15 @@ const OLD_PLUGIN_IDS = [
   'code-graph@sdsrss-code-graph', // v2 legacy ID (pre-rename)
 ];
 const MARKETPLACE_NAME = 'code-graph-mcp';
-const CACHE_DIR = path.join(os.homedir(), '.cache', 'code-graph');
+// Imported, not defined here: five other modules needed these three names and
+// one of them — `user-prompt-context.js`, on the UserPromptSubmit hook path —
+// cannot afford to load this file for them (see cache-paths.js, JS-05).
+//
+// The export surface below is unchanged. Measured rather than asserted, after
+// the first version of this comment claimed `MANIFEST_FILE` was exported from
+// here: `CACHE_DIR` and `INSTALL_LOCK_FILE` are exported and still are;
+// `MANIFEST_FILE` is module-private and always was, so nothing importable moved.
+const { CACHE_DIR, MANIFEST_FILE, INSTALL_LOCK_FILE } = require('./cache-paths');
 // Bound for the `ps` fallback in getActiveCmdlines (pre-ship review 2026-09-06).
 // 2 s matches the other hook-path probes; the floor is what a budget-exhausted
 // hook still gives it, since an empty list degrades to recency-only.
@@ -22,14 +30,12 @@ const PS_PROBE_MIN_MS = 250;
 // plugins when hooks run in shared process context (e.g. claude-mem-lite sets it
 // to its own marketplace path, polluting all subsequent settings.json hook processes).
 const PLUGIN_ROOT = path.resolve(__dirname, '..');
-const MANIFEST_FILE = path.join(CACHE_DIR, 'install-manifest.json');
 const REGISTRY_FILE = path.join(CACHE_DIR, 'statusline-registry.json');
 // Written by the launcher's background install when ITS `npm install -g` step
 // introduced the global shell + platform packages. Uninstall only removes
 // global packages it can prove the plugin installed (marker present) or when
 // the user passes --purge-global — a deliberate user install is never yanked.
 const GLOBAL_INSTALL_MARKER = path.join(CACHE_DIR, 'global-install-marker.json');
-const INSTALL_LOCK_FILE = path.join(CACHE_DIR, 'install.lock');
 const SHELL_PKG = '@sdsrs/code-graph';
 
 // Lazy resolvers — Claude Code's config dir can be overridden by CLAUDE_CONFIG_DIR
@@ -1610,8 +1616,18 @@ function uninstall({ purgeGlobal = false, unadoptAll = false, runNpm = defaultRu
     }
   }
 
-  // 6. Remove cache directory
-  try { fs.rmSync(CACHE_DIR, { recursive: true, force: true }); } catch { /* ok */ }
+  // 6. Remove cache directory — through `removeCacheResidue()`, not a bare
+  // rmSync (JS-17, audit 2026-09-07). Without `--unadopt-all` the sweep above
+  // does not run, so the registry is still NON-EMPTY here and a wholesale wipe
+  // strands every managed block — while step 8's own guidance, and `cli.js`,
+  // tell the user their next move is `--unadopt-all`, which then reads an
+  // absent registry and reports nothing to clean. `adoptedProjects` was
+  // captured at 5.5 for the RETURN value; that capture never protected the
+  // file. With `--unadopt-all` the sweep leaves the registry empty (or holding
+  // only projects whose CLAUDE.md could not be rewritten, which is exactly what
+  // must survive), and `removeCacheResidue` preserves only a non-empty one, so
+  // the clean case still leaves nothing behind.
+  try { removeCacheResidue(); } catch { /* ok */ }
 
   // 6.5. The shared tmp dir (cooldown flags, read-fanout state, interrupted
   // `update-*` staging). Nothing in it outlives an uninstall, and the periodic
@@ -1948,12 +1964,14 @@ function isPluginUninstalled(settings = readJson(settingsPath()) || {}) {
 // of which repos carry a managed CLAUDE.md block. Wiping it strands every block
 // — `uninstall({unadoptAll:true})` afterwards reads an empty registry, reports
 // `unadopted: []`, and the blocks stay in the user's repos with nothing left
-// that knows where they are. `uninstall()` captures the list before calling
-// here; `cleanupDisabledStatusline` does not, and by this function's own comment
-// that is the ONE path guaranteed to run after `/plugin uninstall`. So the
-// preservation belongs here, at the wipe, rather than at each caller — the same
-// "fix it at the shared layer, not per surface" the <external> query filter
-// needed.
+// that knows where they are. No caller can be trusted to protect it first:
+// `cleanupDisabledStatusline` cannot (it is the ONE path guaranteed to run after
+// a CC `/plugin uninstall`, and it has no list), and `uninstall()` did not —
+// it captured the list for its RETURN value and then wiped the file with a bare
+// rmSync, which is the JS-17 data loss (audit 2026-09-07); it routes through
+// here now. So the preservation belongs here, at the wipe, rather than at each
+// caller — the same "fix it at the shared layer, not per surface" the
+// <external> query filter needed.
 function removeCacheResidue() {
   // Path comes from adopt.js rather than a second spelling of the basename —
   // a literal here would silently stop matching the day adopt.js renames it,

package/claude-plugin/scripts/session-init.js

@@ -8,6 +8,7 @@ const {
   cleanupDisabledStatusline, isPluginInactive, isPluginUninstalled, removeCacheResidue,
   readJson, CACHE_DIR, settingsPath, isStaleRelicContext, hookCmdScript,
 } = require('./lifecycle');
+const { UPDATE_STATE_FILE } = require('./cache-paths');
 const { readBinaryVersion, isDevMode, getNewestMtime } = require('./version-utils');
 const { maybeAutoAdopt, isAdopted, unadopt } = require('./adopt');
 const { isNonProjectCwd } = require('./project-detect');
@@ -604,7 +605,7 @@ function consistencyCheck(binary) {
 
   // Check 3: Auto-update incomplete
   try {
-    const statePath = path.join(CACHE_DIR, 'update-state.json');
+    const statePath = UPDATE_STATE_FILE;
     const state = readJson(statePath);
     if (state && state.updateAvailable && state.binaryUpdated === false) {
       issues.push({

package/claude-plugin/scripts/statusline.js

@@ -10,11 +10,11 @@ if (require.main === module) require('./hook-fail-open').installHookFailOpen('st
 
 const { execFileSync } = require('child_process');
 const fs = require('fs');
-const os = require('os');
 const path = require('path');
 const { findBinary } = require('./find-binary');
 const { resolveProjectRoot } = require('./project-root');
 const lifecycle = require('./lifecycle');
+const { UPDATE_STATE_FILE } = require('./cache-paths');
 const { hidden } = require('./proc-opts');
 const cleanupDisabledStatusline = lifecycle.cleanupDisabledStatusline || (() => ({ cleaned: false }));
 
@@ -29,8 +29,7 @@ const cleanupDisabledStatusline = lifecycle.cleanupDisabledStatusline || (() =>
 const STUCK_UPDATE_ATTEMPTS = 5;
 function readUpdateState() {
   try {
-    return JSON.parse(fs.readFileSync(
-      path.join(os.homedir(), '.cache', 'code-graph', 'update-state.json'), 'utf8'));
+    return JSON.parse(fs.readFileSync(UPDATE_STATE_FILE, 'utf8'));
   } catch { return null; /* no state file or unreadable */ }
 }
 function updatePending(st = readUpdateState()) {

package/claude-plugin/scripts/user-prompt-context.js

@@ -8,13 +8,27 @@
 // would swallow the test's own failures.
 if (require.main === module) require('./hook-fail-open').installHookFailOpen('UserPromptSubmit');
 
+// Default per-child allowance, spent through the hook budget below.
+const CHILD_TIMEOUT_MS = 3000;
+
+/**
+ * How long ONE child of this hook may run: the default when nothing armed a
+ * deadline (a test importing this module), or whatever is LEFT of the
+ * UserPromptSubmit budget. `null` means the budget is exhausted — do not run.
+ *
+ * Exported so the three states are testable; `run()` below is a closure over
+ * the resolved binary and cannot be reached from a test (JS-18).
+ */
+function childBudgetMs() {
+  return require('./hook-fail-open').remainingMs(CHILD_TIMEOUT_MS);
+}
+
 // UserPromptSubmit hook: inject relevant code-graph RESULTS based on user's intent.
 // Strategy: PUSH structural context (not suggestions) that Grep/Read cannot provide.
 // This is a CODE INDEX — only inject structural code context (impact, overview, callgraph).
 const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
-const os = require('os');
 // Hook cooldown flags + the restart notice go under cgTmpDir() (a code-graph-mcp/
 // subdir of os.tmpdir()), NOT bare os.tmpdir(): Claude Code overrides $TMPDIR to
 // ~/.claude/tmp/, so bare-tmp flags interleave with transcript captures —
@@ -23,8 +37,11 @@ const os = require('os');
 const { cgTmpDir, cwdHash } = require('./tmp-dir');
 const { hidden } = require('./proc-opts');
 
-// Mid-session install detection: hook fires but no manifest yet.
-const MANIFEST_PATH = path.join(os.homedir(), '.cache', 'code-graph', 'install-manifest.json');
+// Mid-session install detection: hook fires but no manifest yet. The path comes
+// from `cache-paths.js` — deliberately NOT from `lifecycle.js`, which this hook
+// must not load (startup budget); it used to be a third hand-spelled copy of the
+// same three path segments (JS-05).
+const { MANIFEST_FILE: MANIFEST_PATH } = require('./cache-paths');
 
 // --- Per-type rate limiting (replaces single global cooldown) ---
 const COOLDOWNS = {
@@ -516,9 +533,18 @@ function runMain() {
   if (!binary) return;
 
   function run(args) {
+    // JS-18 (audit 2026-09-07): spend the UserPromptSubmit budget, don't ask
+    // for a fresh 3 s. This file armed a deadline at line 1 and then never
+    // consulted it — the literal here plus the `findBinary()` chain above ran
+    // outside it, so a cold cache had the hook killed by Claude Code and the
+    // user saw a hook error on THEIR prompt. `null` means the budget is gone:
+    // do not run (node reads `timeout: 0` as no timeout at all). Returning ''
+    // lands on the same "nothing to say" path as an empty result.
+    const budget = childBudgetMs();
+    if (budget === null) return '';
     return execFileSync(binary, args, hidden({
       cwd,
-      timeout: 3000,
+      timeout: budget,
       encoding: 'utf8',
       stdio: ['pipe', 'pipe', 'pipe'],
       env: buildRunEnv(),
@@ -551,4 +577,4 @@ if (require.main === module) {
   runMain();
 }
 
-module.exports = { COOLDOWNS, shouldSkip, extractFilePaths, extractSymbols, detectIntents, scoreIntent, INTENT_PATTERNS, INTENT_THRESHOLD, determineQueryType, computeQuietHooks, STOP_WORDS, PLAIN_WORD_EXCLUDE, hasSymptom, SYMPTOM_PATTERNS, buildRunEnv };
+module.exports = { COOLDOWNS, shouldSkip, extractFilePaths, extractSymbols, detectIntents, scoreIntent, INTENT_PATTERNS, INTENT_THRESHOLD, determineQueryType, computeQuietHooks, STOP_WORDS, PLAIN_WORD_EXCLUDE, hasSymptom, SYMPTOM_PATTERNS, buildRunEnv, childBudgetMs, CHILD_TIMEOUT_MS };

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.138.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.140.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.138.0",
+  "version": "0.140.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.138.0",
-    "@sdsrs/code-graph-linux-arm64": "0.138.0",
-    "@sdsrs/code-graph-darwin-x64": "0.138.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.138.0",
-    "@sdsrs/code-graph-win32-x64": "0.138.0"
+    "@sdsrs/code-graph-linux-x64": "0.140.0",
+    "@sdsrs/code-graph-linux-arm64": "0.140.0",
+    "@sdsrs/code-graph-darwin-x64": "0.140.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.140.0",
+    "@sdsrs/code-graph-win32-x64": "0.140.0"
   }
 }